DOCKET NO.: MSFT-2568/307781.01 PATENT 
Application No.: 10/750,297 
Office Action Dated: April 9, 2007 

This listing of claims will replace all prior versions, and listings, of claims in the application. 
Listing of Claims: 

1. (Original) A method of processing runtime functions, comprising: 

receiving a call to a runtime function; 

determining associated data from the call to the runtime function; 
determining a target from the associated data; and 
executing the target. 

2. (Original) The method of claim 1, wherein the step of determining the associated data 
comprises accessing data in a data structure connected with the runtime function and 
calculating the associated data based on the accessed data. 

3. (Original) The method of claim 1, further comprising: 

determining if at least a portion of the associated data is valid; and 
preventing execution of the target if the associated data is not valid. 

4. (Original) The method of claim 3, further comprising maintaining a list of valid targets, 
wherein the step of determining if the associated data is valid comprises comparing the target 
to the list of valid targets. 

5. (Original) The method of claim 4, wherein maintaining the list comprises generating the 
list of valid targets at compiler and link time. 

6. (Original) The method of claim 4, wherein maintaining the list comprises generating the 
list of valid targets at runtime. 

7. (Original) The method of claim 3, wherein the step of determining if the associated data is 
valid comprises retrieving a security cookie from the associated data and comparing the 
retrieved security cookie to a list of valid security cookies. 
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8. (Original) The method of claim 3, further comprising determining and storing a 
predetermined calculated value based on at least a portion of the associated data, prior to 
receiving the call to the runtime function. 

9. (Original) The method of claim 8, wherein determining if the associated data is valid 
comprises comparing the predetermined calculated value to another calculated value based on 
the associated data. 

10. (Currently Amended) A tangible computer-readable medium having stored thereon 
computer-executable instructions for performing a method of processing runtime functions, 
the method comprising: 

receiving a call to a runtime function; 

determining associated data from the call to the runtime function; 
determining a target from the associated data; and 
executing the target. 

11. (Original) The computer readable medium of claim 10, wherein the step of determining 
the associated data comprises accessing data in a data structure connected with the runtime 
function and calculating the associated data based on the accessed data. 

12. (Original) The computer readable medium of claim 10, having further computer- 
executable instructions for determining if at least a portion of the associated data is valid, and 
preventing execution of the target if the associated data is not valid. 

13. (Original) The computer-readable medium of claim 12, having further computer- 
executable instructions for maintaining a list of valid targets, wherein the step of determining 
if the associated data is valid comprises comparing the target to the list of valid targets. 
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14. (Original) The computer-readable medium of claim 13, wherein maintaining the list 
comprises generating the list of valid targets at compiler and link time. 

15. (Original) The computer-readable medium of claim 13, wherein maintaining the list 
comprises generating the list of valid targets at runtime. 

16. (Original) The computer-readable medium of claim 12, wherein determining if the 
associated data is valid comprises retrieving a security cookie from the associated data and 
comparing the retrieved security cookie to a list of valid security cookies. 

17. (Original) The computer-readable medium of claim 12, having further computer- 
executable instructions for determining and storing a predetermined calculated value based 
on at least a portion of the associated data, prior to receiving the call to the runtime function. 

18. (Original) The computer-readable medium of claim 17, wherein determining if the 
associated data is valid comprises comparing the predetermined calculated value to another 
calculated value based on the associated data. 

19. (Original) A system for processing runtime functions, comprising: 

a processor that receives a call to a runtime function; and 

a dispatcher system that determines associated data from the call to the runtime 
function, determines a target from the associated data, and executes the target. 

20. (Original) The system of claim 19, wherein the dispatcher system comprises a module to 
access data in a data structure connected with the runtime function and calculate the 
associated data based on the accessed data. 

21. (Original) The system of claim 19, wherein the dispatcher system comprises modules to 
determine if at least a portion of the associated data is valid and prevent execution of the 
target if the associated data is not valid. 
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22. (Original) The system of claim 21, further comprising a storage device that stores a list 
of valid targets, wherein the dispatcher system determines if the associated data is valid by 
comparing the target to the list of valid targets. 

23. (Original) The system of claim 22, further comprising a compiler that generates the list 
of valid targets. 

24. (Original) The system of claim 21, wherein the dispatcher system determines if the 
associated data is valid by retrieving a security cookie from the associated data and 
comparing the retrieved security cookie to a list of valid security cookies. 

25. (Original) The system of claim 21, wherein the processor determines and stores a 
predetermined calculated value based on at least a portion of the associated data, prior to 
receiving the call to the runtime function. 

26. (Original) The system of claim 25, wherein the dispatcher system determines if the 
associated data is valid by comparing the predetermined calculated value to another 
calculated value based on the associated data. 

27. (Original) The system of claim 19, further comprising a compiler and a linker that 
compiles code to produce an executable that is marked with an identifier indicating that the 
executable supports runtime protection. 
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